﻿
// InjectDlg.cpp: 实现文件
//

#include "pch.h"
#include "framework.h"
#include "Inject.h"
#include "InjectDlg.h"
#include "afxdialogex.h"
/*=======================*/
#include <TlHelp32.h>	//获取整个系统进程快照
#define  WECHAT_PROCESS_NAME "WeChat.exe"
#include <stdio.h>
/*=======================*/
#ifdef _DEBUG
#define new DEBUG_NEW
#endif
#include <Windows.h>
#include <iostream>

// 用于应用程序“关于”菜单项的 CAboutDlg 对话框

class CAboutDlg : public CDialogEx
{
public:
	CAboutDlg();

// 对话框数据
#ifdef AFX_DESIGN_TIME
	enum { IDD = IDD_ABOUTBOX };
#endif

	protected:
	virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV 支持

// 实现
protected:
	DECLARE_MESSAGE_MAP()
};

CAboutDlg::CAboutDlg() : CDialogEx(IDD_ABOUTBOX)
{
}

void CAboutDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialogEx::DoDataExchange(pDX);
}

BEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx)
END_MESSAGE_MAP()


// CInjectDlg 对话框



CInjectDlg::CInjectDlg(CWnd* pParent /*=nullptr*/)
	: CDialogEx(IDD_INJECT_DIALOG, pParent)
{
	m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
}

void CInjectDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialogEx::DoDataExchange(pDX);
}

BEGIN_MESSAGE_MAP(CInjectDlg, CDialogEx)
	ON_WM_SYSCOMMAND()
	ON_WM_PAINT()
	ON_WM_QUERYDRAGICON()
	ON_BN_CLICKED(IDC_INJECT, &CInjectDlg::OnBnClickedInject)
	ON_BN_CLICKED(IDC_REMOVE, &CInjectDlg::OnBnClickedRemove)
END_MESSAGE_MAP()


// CInjectDlg 消息处理程序

BOOL CInjectDlg::OnInitDialog()
{
	CDialogEx::OnInitDialog();

	// 将“关于...”菜单项添加到系统菜单中。

	// IDM_ABOUTBOX 必须在系统命令范围内。
	ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);
	ASSERT(IDM_ABOUTBOX < 0xF000);

	CMenu* pSysMenu = GetSystemMenu(FALSE);
	if (pSysMenu != nullptr)
	{
		BOOL bNameValid;
		CString strAboutMenu;
		bNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);
		ASSERT(bNameValid);
		if (!strAboutMenu.IsEmpty())
		{
			pSysMenu->AppendMenu(MF_SEPARATOR);
			pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
		}
	}

	// 设置此对话框的图标。  当应用程序主窗口不是对话框时，框架将自动
	//  执行此操作
	SetIcon(m_hIcon, TRUE);			// 设置大图标
	SetIcon(m_hIcon, FALSE);		// 设置小图标

	// TODO: 在此添加额外的初始化代码

	return TRUE;  // 除非将焦点设置到控件，否则返回 TRUE
}

void CInjectDlg::OnSysCommand(UINT nID, LPARAM lParam)
{
	if ((nID & 0xFFF0) == IDM_ABOUTBOX)
	{
		CAboutDlg dlgAbout;
		dlgAbout.DoModal();
	}
	else
	{
		CDialogEx::OnSysCommand(nID, lParam);
	}
}

// 如果向对话框添加最小化按钮，则需要下面的代码
//  来绘制该图标。  对于使用文档/视图模型的 MFC 应用程序，
//  这将由框架自动完成。

void CInjectDlg::OnPaint()
{
	if (IsIconic())
	{
		CPaintDC dc(this); // 用于绘制的设备上下文

		SendMessage(WM_ICONERASEBKGND, reinterpret_cast<WPARAM>(dc.GetSafeHdc()), 0);

		// 使图标在工作区矩形中居中
		int cxIcon = GetSystemMetrics(SM_CXICON);
		int cyIcon = GetSystemMetrics(SM_CYICON);
		CRect rect;
		GetClientRect(&rect);
		int x = (rect.Width() - cxIcon + 1) / 2;
		int y = (rect.Height() - cyIcon + 1) / 2;

		// 绘制图标
		dc.DrawIcon(x, y, m_hIcon);
	}
	else
	{
		CDialogEx::OnPaint();
	}
}

//当用户拖动最小化窗口时系统调用此函数取得光标
//显示。
HCURSOR CInjectDlg::OnQueryDragIcon()
{
	return static_cast<HCURSOR>(m_hIcon);
}

//获取进程PID
DWORD ProcessNameFindPid(LPCSTR processName)
{
	PROCESSENTRY32 Processinformation = { 0 };
	BOOL Processhandle;
	HANDLE Processsnapshot;

	Processsnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

	if (Processsnapshot != 0)
	{
		Processinformation.dwSize = sizeof(PROCESSENTRY32);
		Processhandle = Process32First(Processsnapshot, &Processinformation);
		while (Processhandle)
		{
			if (lstrcmpi(processName, Processinformation.szExeFile) == 0)
			{
				CloseHandle(Processsnapshot);

				return Processinformation.th32ProcessID;
			}
			Processhandle = Process32Next(Processsnapshot, &Processinformation);
		}
		CloseHandle(Processsnapshot);
	}
	return 0;
}

//获取进程exe当前路径
CString GetCurrentExeDirectory()
{
	TCHAR buffer[MAX_PATH];
	GetModuleFileName(NULL, buffer, MAX_PATH);
	CString path(buffer);
	path = path.Left(path.ReverseFind('\\') + 1);
	return path;
}
#include <afx.h>
VOID InjectDLL() {
	// 获取当前目录路径  
	CString pathStr = GetCurrentExeDirectory() + "Wehelp.dll";

	DWORD PID = ProcessNameFindPid("WeChat.exe");
	if (PID == 0) {
		MessageBox(NULL, "微信未启动", "错误", 0);
		return;
	}
	HANDLE Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID);
	if (NULL == Hprocess) {
		MessageBox(NULL, "无权限:操作失败", "错误", 0);
		return;
	}

	//申请内存
	LPVOID dllAdd = VirtualAllocEx(Hprocess, NULL, sizeof(pathStr), MEM_COMMIT, PAGE_READWRITE);
	if (NULL == dllAdd) {
		MessageBox(NULL, "内存分配失败", "错误", 0);
		return;
	}
	//注入DLL
	if (WriteProcessMemory(Hprocess, dllAdd, pathStr, strlen(pathStr), NULL) == 0) {
		MessageBox(NULL, "DLL注入失败", "错误", 0);
		return;
	}
	//示例字符串输出
	//CHAR test[0x100] = { 0 };
	//sprintf_s(test, "写入地址为：%p", dllAdd);
	//OutputDebugStringA(test);
	HMODULE k32 = GetModuleHandle("Kernel32.dll");
	LPVOID loadAdd = GetProcAddress(k32, "LoadLibraryA");
	HANDLE exec = CreateRemoteThread(Hprocess,NULL,0, (LPTHREAD_START_ROUTINE)loadAdd,dllAdd,0,NULL);
	if (NULL == exec) {
		MessageBox(NULL, "远程注入失败", "错误", 0);
		return;
	}
}

BOOL RemoteFreeLibrary(DWORD dwProcessID, char* lpszDll)
{
	// 打开目标进程
	HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessID);
	// 向目标进程地址空间写入DLL名称
	DWORD dwSize, dwWritten;
	dwSize = strlen(lpszDll);
	LPVOID lpBuf = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
	if (NULL == lpBuf)
	{
		CloseHandle(hProcess);
		return FALSE;
	}
	if (WriteProcessMemory(hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten))
	{
		// 要写入字节数与实际写入字节数不相等，仍属失败
		if (dwWritten != dwSize)
		{
			VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT);
			CloseHandle(hProcess);
			return FALSE;
		}
	}
	else
	{
		CloseHandle(hProcess);
		return FALSE;
	}
	// 使目标进程调用GetModuleHandle，获得DLL在目标进程中的句柄
	DWORD dwHandle, dwID;
	LPVOID pFunc = GetModuleHandleA;
	HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID);
	// 等待GetModuleHandle运行完毕
	WaitForSingleObject(hThread, INFINITE);
	// 获得GetModuleHandle的返回值
	GetExitCodeThread(hThread, &dwHandle);
	// 释放目标进程中申请的空间
	VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT);
	CloseHandle(hThread);
	// 使目标进程调用FreeLibrary，卸载DLL
	pFunc = FreeLibrary;
	hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, (LPVOID)dwHandle, 0, &dwID);
	// 等待FreeLibrary卸载完毕
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
	CloseHandle(hProcess);
	return TRUE;
}

//注入DLL
void CInjectDlg::OnBnClickedInject()
{
	// TODO: 在此添加控件通知处理程序代码
	InjectDLL();
}
//卸载DLL
VOID CInjectDlg::OnBnClickedRemove()
{
	CString pathStr = GetCurrentExeDirectory()+"Wehelp.dll";
	DWORD PID = ProcessNameFindPid("WeChat.exe");
	BOOL bol = RemoteFreeLibrary(PID, (LPTSTR)(LPCTSTR)pathStr);
	if (!bol) {
		MessageBox(NULL, "卸载DLL失败", 1);
		return;
	}
	MessageBox(NULL, "卸载DLL成功", 0);

}


